The United Nation’s AI Advisory publishes AI Governance Report.
In September 2024, the United Nation’s AI advisory body released the “Governing AI for Humanity” Report, aimed at establishing a basis for regulating AI under international law. The report clarifies that international law applies to AI and proposes recommendations to address gaps in the current AI governance landscape, among which are the development of a global data framework ensuring the availability and use of adequately diverse and complete datasets is equal for all stakeholders in all countries, the establishment of an AI standards exchange, and a designated UN AI office.
Israel
In September 2024, Israel joined the Council of Europe’s Framework Convention on Artificial Intelligence, the first legally binding international agreement on AI. The treaty requires Israel to implement measures ensuring that the application of AI systems throughout their lifecycles maintain human dignity, privacy, equality, transparency, safe innovation, security and reliability. It also mandates the adoption of measures to assess and mitigate risks and to ensure compliance through effective oversight.
Europe
ESMA has issued guidance on the use of AI in retail investment services, specifically, how AI may be deployed in compliance with the Markets in Financial Instruments Directive (MIFID II), which applies also to entities outside the EU that offer investment services or conduct investment activities in the EU. The Statement requires firms to clearly inform clients about AI’s role in investment decisions, oversee AI development and risk management, and ensure employees are competent in AI technologies. AI systems must align with client financial goals and be tailored to target markets. Additionally, firms must maintain detailed records of AI usage and any client complaints.
Since ChatGPT’s launch, various Supervisory Authorities have investigated OpenAI for potential data protection violations. In April 2023, the European Data Protection Board (EDPB) formed a taskforce to assess OpenAI’s practices, which recently published a report offering preliminary views on its personal data processing. The main points in the report are the following:
- ChatGPT must ensure GDPR compliance without shifting the responsibility to data subjects by claiming that users are responsible for their inputs, as this would unfairly burden them.
- The impracticality of informing each data subject about the personal data collection via web scraping could justify an exemption of the notification requirements.
- Since the current ChatGPT model may produce biased outputs, the controller needs to inform the users about how the outputs are generated and their limited reliability, including by stating that the output may be biased.
- In addition, it recommends specific safeguards like anonymization and exclusion of sensitive data during training.
US
Following the adoption of Colorado’s pioneering risk-based AI regulation in May 2024 (which we covered in our previous update), Illinois amended the State’s Human Rights Act to address the use of AI in employment matters in August 2024. The amendment prohibits employers from using AI for employment-related decisions. Additionally, it requires employers to notify employees where they use AI for such purposes. The regulation is set to take effect starting January 2026.
In May 2024, the Department of Health and Human Services (“HHS”) finalized its interpretation of Section 1557 of the Affordable Care Act, which prohibits discrimination in health programs receiving federal funding (“Covered Entities”). The HHS requires Covered Entities to make reasonable efforts to identify AI tools employing discriminatory mechanisms or potentially producing discriminatory results. Where such discrimination is found, Covered Entities must deploy measures to mitigate the discrimination risk emanating from such use. These obligations will take effect in May 2025.
- California Introduces Two Landmark AI Bills.
On August 29, 2024, California’s legislators approved the “Generative Artificial Intelligence: Training Data Transparency“bill, which requires developers of generative AI systems or services made available to California residents to disclose information regarding the datasets used for developing and training these systems. Developers must disclose (i) the sources and owners of the datasets; (ii) a description of how the datasets further the purpose of the AI system; (iii) whether the datasets include proprietary data; and (iv) whether the datasets contain personal information or aggregate consumer information. The bill, pending the governor’s approval, will take effect In January 2026.
The “Safe and Secure Innovation for Frontier Artificial Intelligence Models Act״ (also known as SB 1047), also passed in Congress on August 2024, requires developers of certain AI models to: (i) implement the capability to fully shut down the AI system; (ii) deploy safety protocols to avoid unreasonable risk of critical harm and prevent unauthorized access; (iii) conduct an assessment of its potential to cause or enable critical harm, and (iv) promptly report AI safety incidents increasing the risk of critical harm. The bill authorizes the State Attorney General to take civil action against violations which result in severe harm. Following numerous call from Federal legislators and industry stakeholders, the governor of California decided to veto the bill, calling for a more balanced rule-making in this field. California serves as a significant hub for major stakeholders in the AI space.
____________________
This publication is provided as a service to our clients and colleagues, with explicit clarification that each specific case requires individual examination and discussion in writing.
The information presented here is of a general nature and is not intended to answer the unique circumstances of any individual or entity. Although we strive to provide accurate and available information, we cannot guarantee the accuracy of the information on the day it is received, nor that the information will continue to be accurate in the future. Do not act on the information presented without appropriate professional advice after a comprehensive and thorough examination of the specific situation.
